Types  of  Personal

data

Purpose

Legal Basis

Personal data we collect and use if you are a customer or prospective customer

First  name, email

business

(billing   and business

surname,    address, addresses delivery), phone

For the provision of our services, which includes arranging an initial consultation with you,  registering you     as     a     new     customer, processing   orders,   delivery   of

In   most   cases,   this   processing   is

necessary   for   performance   of   a

contract.

Types  of  Personal

data

Purpose

Legal Basis

number / mobile phone number,     job      role, information about your employer                (i.e. company   name   and location  of  business), username,    password and             information provided by you when submitting   a   support ticket (if you register on our  Customer  Portal), details about payments to  and  from  you  and other       details       of products  and  services you   have   purchased from us, your interests, preferences  (including receiving      marketing from  us  and  our  third parties      and      your communication

preferences), feedback and survey responses, interactions  via  social media.

orders,    fulfillment    of    services sending   invoices   and   payment reminders,   collecting   payments, recovering    outstanding    monies and  any  other  general  contract management  and  administration purposes.

Where   you   or   your   company provide   us   with   products   and services, we will collect your data in     order     to     facilitate     the TopTrove-vendor   commercial relationship,  which  includes  the above      purposes      such      as management    of    invoices    and contract management.

However, we also rely on our legitimate interest to recover debts owed to us, if applicable.

To       resolve       any       queries, complaints,        feedback        and requests,    either    through    our Website ‘Contact’ page or through the    support    function    on    our Customer Portal

Our  legitimate  interest to  respond to any  correspondence  or  queries  you send us, and to send service information about our services.

To       send       marketing       and promotional    material,    updates, newsletters, delivery of content via social  media,  and  other  related information that may be of interest to you, including, sending solicited information     (e.g.     quotes     in response to an enquiry), surveys and   promotions,   webinars   and seminars.

We may contact you for the above purposes via  email  and  possibly your   postal   address   or   phone number.

Where required by applicable law, your consent    or    where    information    is solicited.

Otherwise,  our  legitimate  interest  to send  you  communications  related  to similar products or services to which you have  previously  purchased  or  entered into  negotiations  to  purchase,  where permitted by applicable laws.

Names,  email

addresses, business

addresses.

To   conduct   data-analytic   and market research for statistical and survey  purposes  and for  internal business administration.

Our legitimate interest to measure the use of our services and  interaction to inform   and   improve   service/product direction   and   development   and   to enable provision of accurate and reliable reporting.

Types  of  Personal

data

Purpose

Legal Basis

Personal data we collect and use if you use our Website

Information about how you  use  and  interact with  our  services  and website            (“Usage Data”),  such  as  data about your visits to our Website,      your      IP address, browser type and   version,   domain name,      time      zone setting   and   location, browser  plug-in  types and    versions,    click activity,            referring website,        operating system   and   platform and  other  technology on the devices you use to access our Website, your login details (if you register       on        our Customer Portal).

This  data  may  be  automatically collected   through   our   use   of cookies,  server  logs  and  other similar  technologies,  however  it helps  us  to  help  us  to  keep  our Website available and secure.

Where   exceptions   to   the   consent requirement apply, we have a legitimate interest in:

•    to providing and maintaining our Website through utilizing cookies that are strictly necessary, and to ensure it functions and operates efficiently;

•    detecting and preventing fraud and ensuring that your

experience on our Website is as secure as possible.

Where  you  agree  to  applicable cookies, the data collected helps to improve  your   experience  when you visit our Website.

This  includes:  (a)  for  statistical analysis   to   improve,   test   and monitor  the  effectiveness  of  our Website,     troubleshoot     issues related to website navigation and to   inform   decision   making   on changes necessary; (b) to ensure content    on    our    Website    is presented  in  the  most  effective manner for you; and (c) to enhance your use of our Website to monitor metrics  such  as  total  number  of visitors and traffic data (including demographic patterns).

Where required by law, we obtain your consent for cookies and other tracking technologies    that    are    not    strictly necessary, such as cookies relating to performance, functionality and targeting.

.

Personal data we collect and use if you apply for a job with us

First  name,  surname, contact               details (including     residential address, email address

To     respond    to     request    for vacancies  and  for  recruiting  and hiring purposes.

The processing is necessary for us to administer our contract with you – or take steps to consider entering into an employment contract with you.

Types  of  Personal

data

Purpose

Legal Basis

and  phone  number  / mobile phone number), date  of  birth,  gender, national    identification number,   Linkedin profile details, details of your        qualifications, skills   and   education and           professional history,   CV / resume, cover            letters, application       forms, references,   candidate assessment  (including interview            notes); information  relating  to right    to    work    and information about your skills,  experience  and education,         (where applicable) health data required      to      make reasonable

adjustments             for

interviews,          notice

period     and     salary

expectations

To carry out right to work checks and    comply    with    our    legal requirements,  such  as  to  make reasonable adjustments if you are successful in obtaining a position with us.

Necessary   to   comply   with   relevant employment    law    obligations    (for example,  carrying  out  right  to  work checks).

To     improve     our     recruitment process and activities.

Necessary for our legitimate interests to maintain our reputation as a leading employer.

All Data Subjects

All        data        above

mentioned.

In  connection  with  any  merger, sale,   transfer   of   our   assets, investment,                  acquisition, bankruptcy,  or  similar  event  or corporate transaction.

In   these   circumstances,   processing would be necessary for our legitimate interests to ensure we can protect and grow our business.

All        data        above

mentioned.

Ensuring   our   compliance   with legislation and legal process.

We  have  a  necessity to  comply with our legal obligations such as providing information in the context of our tax and financial legal obligations.

All        data        above

mentioned.

Establishing our rights or defend ourselves against any dispute that may arise.

We   have   a   legitimate   interest   to ascertain, exercise and / or defend our rights    and    ensure    our    business continuity.

Types    of    Personal

data

Purpose

Legal Basis

All        data        above

mentioned.

To help us improve and optimize our products and services.

Where   exceptions   to   the   consent requirement apply, we have a legitimate interests to maintain our reputation as a leading provider of application security testing  solutions  to  customers  across the globe.

Personnel: Personal data is shared internally on a need-to-know basis to our  staff  and  personnel  including  directors,  shareholders,  employees, contractors and other temporary workers.

External Recipients

Service Providers and Data Processors: We engage third party vendors, from time to time, including:

•    IT service providers such as Microsoft and Kaseya to help manage our IT and back office systems;

•    website  and  email  marketing  service  providers,  such  as  Guru, WordPress, MailChimp and GoogleAds;

•    analytics  and  search  engine  providers  such  as  Microsoft  Bing Adverts and Google Analytics to help us improve and optimize our services;

•    professional advisors, such as tax or legal advisors (for example, as necessary for the establishment, exercise or defence of legal claims or to protect our rights or safety);

•    recruitment agencies;

•    agents,   suppliers   or   sub-contractors   and   other   associated organisations where they  are  engaged  by  us  to  help  deliver  a service that we have instructed them on, such as Sage for customer invoicing and DocuSign to conclude customer contracts;

•    (where you attend a TopTrove hosted or sponsored event) event organizers, logistic and production companies in connection with events that you may attend;

Third parties in case of a legal requirement: We disclose your personal data if disclosure is required by law or in the context of an investigation, regulatory requirement, judicial proceeding, court order or legal process (including to law enforcement or competent authorities like the police and tax authorities).

Third parties in case of a corporate transaction: Information about our customers,  including  personal  data,  may  be  disclosed  as  part  of  any merger, sale, transfer of our assets, investment, acquisition, bankruptcy, or similar  event,  including  while  engaging  with  our  actual  or  potential investors.

Right

What this means

Access

You can ask us to:

•    confirm whether we are processing your personal data;

•    give you a copy of the personal data we hold about you; or

•    provide you with other information about your  personal data such as what data we have, what we use it for, who we disclose it to, whether we transfer it abroad and how we protect it, how long we keep it for, what rights you have, how you can make a complaint, where we got your data from etc., to the extent that information has not already been provided to you in this Policy.

Rectification

You can ask us to rectify inaccurate or incomplete personal data. We may seek to verify the accuracy of the data before rectifying it.

Erasure

You can ask us to erase your personal data, but only where:

•    it is no longer needed for the purposes for which it was collected;

•    you have withdrawn your consent (where the data processing was based on consent);

•    following a successful right to object (see ‘Objection’ below);

•    it has been processed unlawfully; or

•    to comply with a legal obligation to which we are subject.

We are not required to comply with your request to erase your personal data if the processing of your personal data is necessary:

•    for compliance with a legal obligation; or

•    for the establishment, exercise or defence of legal claims.

There are certain other circumstances in which we are not required to comply with your erasure request, although these two are the most likely circumstances in which we would deny that request.

Restriction

You can ask us to restrict (i.e. keep but not use) your personal data, but only where:

•    its accuracy is contested (see “ Rectification” above), to allow us to verify its accuracy; or

•    the processing is unlawful, but you do not want it erased; or

•    it is no longer needed for the purposes for which it was collected, but we still need it to establish, exercise or defend legal claims; or

•    you have exercised the right to object, and verification of overriding grounds is pending.

We can continue to use your personal data following a request for restriction, where:

•    we have your consent; or

•    to establish, exercise or defend legal claims; or

•    to protect the rights of another natural or legal person.

Portability

You can ask us to provide your personal data to you in a structured, commonly used, machine-readable format or you can ask to have it ‘ported’ directly to another data controller, but in each case only where:

•    the processing is based on your consent or on the performance of a contract with you; an

•    the processing is carried out by automated means.

Objection

You can object to any processing of your personal data which has our ‘legitimate interests’ as its legal basis (see PERSONAL DATA WE COLLECT, WHEN AND WHY WE USE IT, AND OUR LAWFUL BASIS FOR PROCESSING IT above) if you believe your fundamental rights and freedoms outweigh our legitimate interests.

Once you have objected, we have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms.

International Transfers

You can ask to obtain a copy of, or reference to, the safeguards under which your personal data is transferred outside of the UK, European Economic Area, Canada & Australia. We may redact  data  transfer  agreements  or  related  documents  (i.e.  obscure  certain information contained within these documents) for reasons of commercial sensitivity.

Supervisory Authority

You have a right to lodge a complaint with your local supervisory authority about our processing of your personal data.   In  the  UK,  the supervisory authority for data protection is the Information Commissioner’s Office or ICO (https://ico.org.uk/). We ask that you please attempt to resolve any issues with us first, although you have a right to contact your supervisory authority at any time.

Withdrawal of consent

If you have given your consent to the processing of your personal data, you can revoke it at any time with effect for the future. The lawfulness of the processing of your data before this remains unaffected.